Certificate Authority/Browser Forum

Certificate Authority/Browser Forum
Name	Certificate Authority/Browser Forum
Abbreviation	CA/Browser Forum
Formation	2005
Type	Consortium
Region	International
Membership	Certificate authorities, browser vendors

Certificate Authority/Browser Forum The Certificate Authority/Browser Forum is a voluntary consortium founded in 2005 that coordinates technical and policy standards among DigiCert, Entrust, GlobalSign, Sectigo, Let’s Encrypt, Google, Mozilla', and other industry stakeholders. It develops interoperable requirements and guidelines for public X.509 TLS/SSL certificate issuance and management to align practices used by Microsoft Corporation, Apple Inc., Oracle Corporation, Cisco Systems, and other platform providers. The Forum’s work influences browser and operating system trust stores overseen by organizations such as the Internet Engineering Task Force, World Wide Web Consortium, and national authorities including the National Institute of Standards and Technology.

History

The Forum originated after high-profile incidents involving Comodo Group, DigiNotar, Symantec Corporation (including the Symantec PKI controversy), and disputes among browser vendors like Mozilla and Google about certificate trust. Early meetings involved representatives from VeriSign, Entrust, GoDaddy, Thawte, GeoTrust, and browser teams from Mozilla Foundation and Google LLC to draft baseline policies. Over time the Forum expanded to include newer providers such as Let’s Encrypt and platform vendors including Apple Inc. and Microsoft Corporation. Major milestones include publication of the Baseline Requirements and later incorporation of guidance responding to crises like the DigiNotar breach and evolving concerns raised after incidents involving SHA-1 deprecation and Certificate Transparency adoption championed by Google.

Membership and Governance

Membership comprises major certificate authorities like DigiCert, GlobalSign, Sectigo, Entrust, IdenTrust, and newer authorities such as Let’s Encrypt, alongside browser vendors including Google, Mozilla, Microsoft, and Apple. The Forum operates through a Steering Committee and ballot process influenced by corporate members from organizations such as Amazon Web Services, Cloudflare, Akamai Technologies, Facebook, Inc., and PayPal. Governance draws on procedures similar to those used by standards bodies like the Internet Engineering Task Force and World Wide Web Consortium with formal proposal, ballot, and vote phases involving participants including Trend Micro, Comodo, SwissSign Group, QuoVadis, and representatives from academic institutions like Massachusetts Institute of Technology and Stanford University.

Baseline Requirements and Guidelines

The Forum’s flagship output is the Baseline Requirements for the Issuance and Management of Publicly-Trusted Certificates, which prescribes practices for certificate lifecycle, identity vetting, key sizes, and revocation protocols. These requirements integrate cryptographic guidance from bodies including the National Institute of Standards and Technology, recommendations from the Internet Engineering Task Force (e.g., RFC 5280), and deployment realities voiced by vendors such as Mozilla, Google, and Microsoft. The guidelines address certificate profiles used by providers like DigiNotar (historically), VeriSign (now part of Symantec lineage), and Entrust, and align with transparency initiatives promoted by Google and operational tooling from Cloudflare and Akamai Technologies.

Technical Working Groups and Policies

The Forum organizes Technical Working Groups focused on areas such as Domain Validation, Certificate Transparency, Revocation, and TLS Server Authentication, with participants from Let’s Encrypt, DigiCert, GlobalSign, Sectigo, Entrust, and browser engineers from Mozilla, Google, and Microsoft. Working groups produce ballots and proposals that affect standards adopted by ecosystem actors like OpenSSL, BoringSSL, GnuTLS, and server vendors including NGINX and Apache HTTP Server. Collaborative outputs reference cryptographic standards from RSA Security, Elliptic Curve Cryptography research groups, and policy frameworks used by governments such as the United Kingdom Government and agencies like the European Union Agency for Cybersecurity.

Certificate Validation and Trust Practices

The Forum’s policies influence how applications validate certificates and manage trust stores maintained by Microsoft Windows, Apple macOS, Linux distributions (packagers like Red Hat and Debian), and browsers including Google Chrome, Mozilla Firefox, and Safari. Requirements affect revocation checking mechanisms such as OCSP and CRLs used by infrastructures operated by Cloudflare, Akamai Technologies, and content delivery networks owned by Amazon Web Services. The Forum endorses practices that intersect with initiatives like Certificate Transparency logs maintained by Google and audited by organizations such as Censys and SecurityTrails.

Criticisms and Controversies

Critics have challenged the Forum for perceived concentration of influence among large commercial CAs such as DigiCert and legacy players like Symantec and for alleged insufficient representation of smaller CAs and civil society organizations such as Electronic Frontier Foundation. Controversies include responses to the Symantec PKI controversy, debates over enforcement of short-lived certificates advocated by entities like Let’s Encrypt, and disputes about transparency and ballot governance echoed by academic researchers at University of California, Berkeley and University of Cambridge. Some governments and firms (e.g., Baidu, Tencent) questioned WDUs of Forum policies in cross-jurisdictional contexts involving national root programs like those operated by China Internet Network Information Center.

Impact on Internet Security and Adoption

The Forum’s Baseline Requirements and technical guidance have materially affected adoption of HTTPS across websites served by providers like Cloudflare, Akamai, Amazon Web Services, and hosting firms including GoDaddy and Bluehost. By coordinating standards with browser vendors such as Google and Mozilla, the Forum helped drive deprecation of weak algorithms (e.g., SHA-1), increased deployment of Certificate Transparency, and stimulated automation efforts epitomized by Let’s Encrypt and the ACME protocol. Its policies continue to shape trust ecosystems relied upon by financial institutions like JPMorgan Chase, technology firms such as Facebook, Inc., and critical infrastructure operators including Verizon Communications and AT&T.

Category:Internet security organizations